from scapy.all import *  #scapy 
import subprocess		 #OS commands

class Monitor:

	#Dictionary that maps the IPs used by the client to represent the 
	#honeypots in their own network to those used in EC2 by the actual honeypots
    #form: {"str:clientIP":"str:EC2IP", "":"", ...}
	l3Map = dict()


	def __init__(self, l3Map):
		self.l3Map = l3

	def sniffer(self):
		sniff(prn=self.sniffer_callback, iface="eth0",  store=0)
		
	def sniffer_callback(self,packet):
		if IP in packet:
			#Compose data of new IP header
			new_srcIP = subprocess.check_output("ip addr show eth0 | tail -3 | head -1 | awk '{print $2}' | cut -d '/' -f1", shell=True).strip()
			new_dstIP ="".join([self.l3Map[key] for key in self.l3Map.keys() if str(key) == str(packet[IP].dst)]) 
			if TCP in packet:
				send(IP(src=str(new_srcIP), dst=str(new_dstIP))/TCP(sport=packet[TCP].sport, dport=packet[TCP].dport)/packet.lastlayer())
			elif UDP in packet:
				send(IP(src=str(new_srcIP), dst=str(new_dstIP))/UDP(sport=packet[UDP].sport, dport=packet[UDP].dport)/packet.lastlayer())		
		return 
		
		

l3Map = {"192.168.1.90":"10.1.1.1"}

mon = Monitor(l3Map)
print mon.sniffer()
